±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36575
New Yesterday: 4 Visitors: 176

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Procedure for CP evidence?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3 ... 10, 11, 12 


Re: Procedure for CP evidence?

Post Posted: Jan 16, 14 17:56

Is there a documented guideline for handling CP in the UK?

I work in a corporate environment providing a number of security services to large UK company. As part of this I provide some forensic services. As part of a recent investigation, I identified what I believed to be CP. At this point, the investigation was halted, the client informed, and law enforcement engaged.

No problem with any of this.

I've subsequently been asked by the company's HR/legal team for some information on the evidence found. I have responded to say that I have nothing I can provide them as little analysis was done, because in line with accepted guidelines, I ceased the investigation immediately on finding CP.

I'm now being asked to provide them with information on where these guidelines are documented, and to date I have been unable to do so. I initially thought it would be under the ACPO guidelines, but I have been unable to find it there.  


Re: Procedure for CP evidence?

Post Posted: Jan 16, 14 18:57

- leafhound

What about the examiners that dogo to the police with what they find and find themselves being arrested because i know that this happens far too often.

This is a long and very interesting thread. I have been following it for some time as I have (unfortunately) had a lot of experience dealing with these types of investigations as an examiner for a Federal Law Enforcement Agency. I have been waiting for the repeated requests for citations supporting the above claim. To even spread poison like this through the DF community is offensive in itself. Sparing members of this forum a long rant about your unethical decision to promote a fear of reporting a crime, I instead offer you the 18 U.S. Code, protecting any forensic examiner, in any capacity from prosecution for reporting a crime.

18 U.S. Code § 2252

(c) Affirmative Defense.— It shall be an affirmative defense to a charge of violating paragraph (4) of subsection (a) that the defendant—
(1)possessed less than three matters containing any visual depiction proscribed by that paragraph; and

(2)promptly and in good faith, and without retaining or allowing any person, other than a law enforcement agency, to access any visual depiction or copy thereof—
(A)took reasonable steps to destroy each such visual depiction; or

(B)reported the matter to a law enforcement agency and afforded that agency access to each such visual depiction.  

Senior Member

Re: Procedure for CP evidence?

Post Posted: Jan 16, 14 19:44

- pmurton
Is there a documented guideline for handling CP in the UK?

In the UK, you will have to use IIOC as search term. Shocked

I guess that what you should obtain, one way or the other, is coverage under Section 10 of the Computer Misuse Act 1990, not unlikely what an expert contractor for the Police may obtain to even get near those data again, see page 33 and following of these ACPO guidelines:
i.e. the unwritten part is seemingly that if you don't stop and report to Police immediately you are actually committing a crime.

See if these fit:

And the whole thread:
may provide insights.

- In theory there is no difference between theory and practice, but in practice there is. - 


Re: Procedure for CP evidence?

Post Posted: Feb 08, 18 19:51

I agree with the consensus here. In my discussions with ILF and others, if you even get a inkling of actual content, DO NOT capture or do anything with it. Stop immediately, notify your contacts if in corporate environment and ensure they report to LE. I would advise you also contact your local counsel and ensure you disclose to them what is required.

In essence, like they said - stop, drop and roll. Do not tamper, copy, record or do anything with actual content otherwise you will also likely face some criminal charges yourself. As crazy as this sounds, ensure you have a direct line to your local field office or via Infraguard - you will be provided with the means to communicate that should that situation ever arise.

In this profession, hope for the best - plan for the worst.  

Page 12 of 12
Page Previous  1, 2, 3 ... 10, 11, 12